Q1 


Q2 


Q3 


Q4 


We intend to revise the code to address the impact of changes in data protection 
legislation, where these changes are relevant to data sharing. What changes to the 
data protection legislation do you think we should focus on when updating the code? 
What to include Contractual Clauses Controller to Controller when processing not determined jointly. 
Where it is envisaged that a processor will become a controller later with its own determined processing 
activities. Should the contract reflect Controller from the beginning or at point where it is no longer 


considered a processor. Data subjects are made aware in advance when no longer deemed Procesor 
only. 


Apart from recent changes to data protection legislation, are there other 


developments that are having an impact on your organisation's data sharing practice 
that you would like us to address in the updated code? 


Yes 
go No 


Please specify 


Examples of compatibility after data sharing, For Statistical Research 


Does the 2011 data sharing code of practice strike the right balance between 


recognising the benefits of sharing personal data and the need to protect it? Please 
give details. 


0O Yes 
No 


Q5 In what ways does it achieve this? 


Q6 In what ways does it fail to strike the right balance? 


Disclosure to Data Subjects if organisation knows what is held then they should be 
made to divulge on a data subject request whilst making the main controller aware 


Q7 What types of data sharing (eg systematic, routine sharing or exceptional, ad hoc 
requests) are covered in too much detail in the 2011 code? 


Dont consider to much detail 


Q8 What types of data sharing (eg systematic, routine sharing or exceptional, ad hoc 
requests) are not covered in enough detail in the 2011 code? 


More detail for what is deemed occasional processing 


Q9 Is the 2011 code relevant to the types of data sharing your organisation is involved 
in? If not, which additional areas should we cover? 


Would like to see code cover activities for a Consultancy that based on its research 
conducted for its client controller, conducts its own statistical research on the data 
collected outside of client agreement 


Q10 Please provide details of any case studies or data sharing scenarios that you would 
like to see included in the updated code? 


Consultant who is also a Research Organisation 


Q11 Is there anything the 2011 code does not cover that you think it should? Please 
provide details. 
Update Data Processor not have responsibilities of it own Articles 28 and 82 
Q12 


In what other ways do you think the 2011 code could be improved? 


Data collected by a third party direct from data subjects on behalf of original party, 
should not be in position to demand the data for there own consideration. Even 
though they commisioned the data subject would not expect individual responces to 
be supplied to original organisation unless expressley told inn privacy notice. Detail 


regarding when third party "carefully selected partners" should be included in a 
privacy notice by the data collector. 


About you 


Q13 Are you answering these questions as: 
O A public sector worker? 
© A private sector worker? 
O A third or voluntary sector worker? 
O A member of the public 
O A representative of a trade association 
O A data subject 
O An ICO employee 


O Other 


Q1i4 Please specify 


Q15 Please provide more information about the type of organisation you work for, ie a 
bank, a housing association, a school. 


Consultancy and Research Organisation - Best Companies Limited 


Q1i6 We may want to contact you about some of the points you have raised. If you are 
happy for us to do this please provide your email address: 


Thank you for taking the time to share your views and experience. 


